Tuesday 8 August 2006

Cost of fighting computer crime in New Zealand revealed for first time

- Otago University survey highlights lack of security training -

New Zealand organisations spend on average about half a million dollars annually fighting computer crime within their organisations, according to a new University of Otago survey.

The inaugural 2005 New Zealand Computer Crime and Security Survey, produced by the University’s Security Research Group, is the first survey of its kind to review information technology security in New Zealand.

The survey is based on the annual Computer Crime and Security Survey conducted by the United States-based Computer Security Institute (CSI) and the Federal Bureau of Investigation’s (FBI) Computer Intrusion Squad, which aims to raise the level of security awareness and determine the scope of computer crime in the US.

The CSI/FBI survey has been running for the past 11 years. A similar survey has been conducted in Australia for the past six years by the Computer Emergency Response Team (AustCERT).

Until now, New Zealand has been reliant on the data from these surveys to guide its computer security responses.

The New Zealand survey, released this month, considered prevalence of security incidents, percentage of information technology department budget spent on security issues, use of cyber-security incident insurance, and intruder detection systems and other technologies, as well as popularity of workstation operating systems.

More than 200 organisations and government agencies responded to the survey (a 43% response rate). Of the respondents, more than 87% indicated they had experienced some form of security incident ranging from virus contamination or computer/laptop theft to abuse of email/net access, or illegal music/movie downloads.

KJ Spike Quinn of the University’s Security Research Group says the average financial cost of security incidents per organisation was around $452,000. Two-thirds of respondents believed aspects of security were inappropriately funded, he says.

“While most of the organisations reported they have at least some security technologies in place, not many organisations have staff with adequate training in IT security. Few organisations are prepared for preserving digital evidence of computer-related incidents,” says Mr Quinn.

This finding reinforces results from another study he completed last year which assessed IT managers on their knowledge of protecting a trail of electronic evidence for use in court.

“Most organisations did not have a forensic policy or realise the importance of it – it didn’t feature on their radar. The commercial and legal implications of this are huge. Knowing how to preserve digital evidence in a way that makes it admissible in court is crucial. The protection of data can mean the difference between a conviction and a case being thrown out in a court of law,” he says.

Mr Quinn is now finalising the 2006 New Zealand Computer Crime and Security Survey in collaboration with the Centre for Critical Infrastructure Protection, the New Zealand Police and CSI in the US.

The results from this second survey will be published on completion later this year. The 2007 results will be published next June to coincide with the release of the 2007 CSI/FBI and AustCERT results.

The full report of the 2005 New Zealand Computer Crime and Security Survey can be found at http://eprints.otago.ac.nz/342

ENDS

Gordon Campbell: On John Key’s Agenda For The Nation

There seemed to be three main components to John Key’s speech:

a) tax cuts largely paid for by a hike in GST
b) mining in national parks and on conservation land, while building more roads.
c) giving firms easier access to the r&d from Crown Research Institutes, so that business can continue to get the taxpayer to pick up the tab for the research that keeps them competitive.

After all, corporate welfare is always such a blessed thing – its only social welfare that corrodes enterprise and ambition. More>>